In Splunk Connect for Kafka version 2.2, when Kerberos authentication is used with the HTTP Event Collector in Splunk Enterprise, the software fails to correctly validate certificates. This improper validation occurs because the Kerberos authentication path bypasses the configured certificate validation settings when building the HTTP client. As a result, an unauthenticated attacker who can intercept network traffic could read or alter all relevant data sent from the connector. The vulnerability affects version 2.2 specifically and has a CVSS 3.1 base score of 7.4, indicating high severity.

An unauthenticated attacker positioned in the network path can read or modify sensitive data transmitted from Splunk Connect for Kafka to Splunk Enterprise when Kerberos authentication is enabled. This compromises confidentiality and integrity of the data flow without requiring authentication or user interaction. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling Kerberos authentication with HTTP Event Collector or avoid using affected versions. Follow Splunk's official documentation for security configurations and monitor for vendor updates regarding a fix.